@farcaster/snap 1.16.1 → 1.16.3

package/dist/schemas.d.ts

@@ -68,6 +68,11 @@ export type SnapHandlerResult = {
     effects?: z.input<typeof snapResponseSchema>["effects"];
     ui: SnapSpecInput;
 };
+/**
+ * @deprecated `nonce` and `audience` are currently optional for backward
+ * compatibility but will become **required** in a future major version.
+ * Clients should always include both fields.
+ */
 export declare const payloadSchema: z.ZodObject<{
     fid: z.ZodNumber;
     inputs: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodArray<z.ZodString>]>>>;

package/dist/schemas.js

@@ -31,12 +31,19 @@ const postInputValueSchema = z.union([
     z.boolean(),
     z.array(z.string()),
 ]);
+/**
+ * @deprecated `nonce` and `audience` are currently optional for backward
+ * compatibility but will become **required** in a future major version.
+ * Clients should always include both fields.
+ */
 export const payloadSchema = z
     .object({
     fid: z.number().int().nonnegative(),
     inputs: z.record(z.string(), postInputValueSchema).default({}),
     timestamp: z.number().int(),
+    /** @deprecated Will become required. Clients should always send a unique nonce. */
     nonce: z.string().optional(),
+    /** @deprecated Will become required. Clients should always send the target server origin. */
     audience: z.string().optional(),
 })
     .strip();

package/dist/server/parseRequest.js

@@ -77,13 +77,21 @@ export async function parseRequest(request, options = {}) {
             },
         };
     }
-    // Audience validation: only enforce when the client sends an audience field.
-    // v1 clients may not include nonce/audience yet.
+    // Deprecation: nonce and audience will become required in a future major version.
+    if (body.nonce === undefined || body.audience === undefined) {
+        console.warn("[snap] POST payload is missing nonce and/or audience. " +
+            "These fields will be required in a future major version. " +
+            "Please update your client to include both fields.");
+    }
     if (body.audience !== undefined) {
         let expectedOrigin = options.requestOrigin;
         if (expectedOrigin === undefined) {
             try {
-                expectedOrigin = new URL(request.url).origin;
+                const url = new URL(request.url);
+                const proto = request.headers.get("x-forwarded-proto") ??
+                    url.protocol.replace(":", "");
+                const host = request.headers.get("x-forwarded-host") ?? url.host;
+                expectedOrigin = `${proto}://${host}`;
             }
             catch {
                 // do nothing

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@farcaster/snap",
-  "version": "1.16.1",
+  "version": "1.16.3",
   "description": "Farcaster Snaps 🫰",
   "repository": {
     "type": "git",

package/src/schemas.ts

@@ -81,12 +81,19 @@ const postInputValueSchema = z.union([
   z.array(z.string()),
 ]);
 
+/**
+ * @deprecated `nonce` and `audience` are currently optional for backward
+ * compatibility but will become **required** in a future major version.
+ * Clients should always include both fields.
+ */
 export const payloadSchema = z
   .object({
     fid: z.number().int().nonnegative(),
     inputs: z.record(z.string(), postInputValueSchema).default({}),
     timestamp: z.number().int(),
+    /** @deprecated Will become required. Clients should always send a unique nonce. */
     nonce: z.string().optional(),
+    /** @deprecated Will become required. Clients should always send the target server origin. */
     audience: z.string().optional(),
   })
   .strip();

package/src/server/parseRequest.ts

@@ -148,13 +148,25 @@ export async function parseRequest(
     };
   }
 
-  // Audience validation: only enforce when the client sends an audience field.
-  // v1 clients may not include nonce/audience yet.
+  // Deprecation: nonce and audience will become required in a future major version.
+  if (body.nonce === undefined || body.audience === undefined) {
+    console.warn(
+      "[snap] POST payload is missing nonce and/or audience. " +
+        "These fields will be required in a future major version. " +
+        "Please update your client to include both fields.",
+    );
+  }
+
   if (body.audience !== undefined) {
     let expectedOrigin = options.requestOrigin;
     if (expectedOrigin === undefined) {
       try {
-        expectedOrigin = new URL(request.url).origin;
+        const url = new URL(request.url);
+        const proto =
+          request.headers.get("x-forwarded-proto") ??
+          url.protocol.replace(":", "");
+        const host = request.headers.get("x-forwarded-host") ?? url.host;
+        expectedOrigin = `${proto}://${host}`;
       } catch {
         // do nothing
       }